MDS Matrices with Lightweight Circuits

Abstract

MDS matrices are an important element for the design of block ciphers such as the AES. In recent years, there has been a lot of work on the construction of MDS matrices with a low implementation cost, in the context of lightweight cryptography. Most of the previous efforts focused on local optimization, constructing MDS matrices with coefficients that can be efficiently computed. In particular, this led to a matrix with a direct xor count of only 106, while a direct implementation of the MixColumn matrix of the AES requires 152 bitwise xors. More recently, techniques based on global optimization have been introduced, where the implementation can reuse some intermediate variables. In particular, Kranz et al. used optimization tools to find a good implementation from the description of an MDS matrix. They have lowered the cost of implementing the MixColumn matrix to 97 bitwise xors, and proposed a new matrix with only 72 bitwise xors, the lowest cost known so far. In this work we propose a different approach to global optimization. Instead of looking for an optimized circuit of a given matrix, we run a search through a space of circuits, to find optimal circuits yielding MDS matrices. This results in MDS matrices with an even lower cost, with only 67 bitwise xors.

Four by four MDS matrices with the fewest XOR gates based on words

“…The other way is directly constructing MDS matrices with xor gates as few as possible. In 2018, Duval and Leurent presented a method to construct lightweight MDS matrices in [10]. They started from an identity matrix and checked the MDS property of the matrix after each linear operation.…”

“…Our work is based on the same observation as the work of [10]. We consider the linear operations as elementary block matrices of three types.…”

“…In this paper, we define a new metric, the value of which is not less than the used metric s-xor, called sequential xor count based on words (sw-xor) to estimate area costs and propose a new concept path to search for MDS matrices. Compared with the searching process in [10], we take different measures to reduce the search space. By using our filter algorithm, the search space is significantly reduced, whereas the method in [10] uses limited number of Multiplication operations or circuit depth.…”

“…Compared with the searching process in [10], we take different measures to reduce the search space. By using our filter algorithm, the search space is significantly reduced, whereas the method in [10] uses limited number of Multiplication operations or circuit depth. Moreover, we do not use the Copy operation during the process.…”

“…For the special case of matrices over finite fields, the lower bound is 8n + 3. Compared with [10], our method is more suitable for finding lightweight MDS matrices over GL(n, F 2 ). A comparison of our results with previous known constructions of MDS matrices with the fewest xor gates is listed in Table 1.…”